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VOLUME XVI 

UNITED STATES 
VS. 

MANNING, Bradley E., PFC COURT-MARTIAL 

U.S. Army, xxx-xx-9504 

Headquarters and Headquarters Company, 

U.S. Army Garrison, 

Joint Base Myer-Henderson Hall, 

Fort Myer, VA 22211 

/ 

The hearing in the above-eitled matter 
was continued on Tuesday, July 9, 2013, at 1:22 p.m., 
at Fort Meade, Maryland, before the Honorable Colonel 
Denise Lind, Judge. 
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DISCLAIMER 

This transcript was made by a court 
reporter who is not the official Government reporter, 
was not permitted to be in the actual courtroom where 
the proceedings took place, but in a media room 
listening to and watching live audio/video feed, not 
permitted to make an audio backup recording for 
editing purposes, and not having the ability to 
control the proceedings in order to produce an 
accurate verbatim transcript. 

This unedited, uncertified draft 
transcript may contain court reporting outlines that 
are not translated, notes made by the reporter for 
editing purposes, misspelled terms and names, word 
combinations that do not make sense, and missing 
testimony or colloquy due to being inaudible to the 
reporter . 
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PROCEEDINGS 

THE COURT: Please be seated. The court is 
called to order. Let the record reflect all those 
present in the court at the last recess are again 
present and the witness is on the witness stand. 

All right. I have been presented with 
three cases from the government. 

MR. FEIN: Yes, ma'am. The United States 
sent an E-mail just a little bit ago explaining where 
the fourth case is. The federal case of USA v. Kim is 
under seal. It was released this morning. An 
unclassified, redacted version was released under seal 
and the federal prosecutors are right now in session. 
It started at 13:00 today, asking the Federal Court if 
they could release it to this court in defense in order 
it to be referenced and we have not received a reply 
yet because they went into session at 13:00. 

THE COURT: All right. So where are we 
with the — you want to move the books in? 

MR. COOMBS: Yes, Your Honor. 

I guess two things. One, if the government 
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is aware of some information that they might be able to 
give a proffer to the court what they're hoping that 
opinion might say that would reference the first prong 
that we believe the three cases that they gave to the 
court doesn ' t address and that ' s whether or not this 
information would be potentially damaging or useful to 
the enemy. We believe that the court would still 
consider even the non-CSRTs in ARB information for that 
purpose . 

THE COURT: Does the case that's 
forthcoming address the first or the second part of — 
relate to the national defense, whether it would be 
potentially damaging to the United States or might be 
useful to a enemy of the United States, with is prong 
one, or closely held, which is prong two. 

MR. COOMBS: It addresses prong one, Your 
Honor. We believe it's on point and it would be 
beneficial to the court to consider it. 

THE COURT: Well, then how do you want to 

proceed? 

MR. COOMBS: The defense would recommend 
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that the government go ahead and give a proffer if 
they're aware of what information is and then, 
depending upon what they say, I may even concede, for 
the purposes of today ' s argument , that the court could 
accept that as the gospel coming from the D.C. Circuit 
and then make a determination. 

THE COURT: Is it a D.C. Circuit case or a 
district court case? 

MR. MORROW: It ' s a trial. 

THE COURT: Do you know what the proffer is 
going to be or are you in a position where you can say 
that yet because it's under seal? 

MR. MORROW: Your Honor, I would rather 
not . It ' s under seal . I would rather not . 

THE COURT: Well, let's look at the closely 
held piece, then. You've given me three cases that all 
address "closely held." 

MR. MORROW: Yes, and, actually, at least 
(inaudible) cases were related to the instructions, 
your draft instructions with respect to the sort of 
whether you can consider when something is closely held 
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and it ' s in sources lawfully available to the public 
and released by the government or information itself 
that contributed to the — the sources of information 
that contributed the information that's at issue, 
whether that stuff has been released by the government. 

THE COURT: So what about the last line of 
the instruction? I drew my instructions directly from 
United States vs. Abu Jihaad, United States vs. 
Sulocoat (phonetic) and United States vs. O'Brien. 

So with the instruction that I'm going to 
give or I would have given to members is essentially 
the same. 

MR. MORROW: We agree, Your Honor. We just 
don't think that that instruction encompasses 
information that ' s just on the Internet . 

THE COURT: Well, what about the last 
sentence where the sources of information are lawfully 
available to the public and the United States 
government has made no effort to guard such 
information, the information does not relate to the 
national defense? 
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MR. MORROW: Our position in that case, 
Your Honor, is that — the government's position that 
the detainee assessment briefs were not public. They 
were not public. The second prong, then, were the 
sources of information. So our government's position 
would be that would be the intelligence reporting that 
goes into the dabs (phonetic) , the interrogation 
reports, et cetera, where that has also not been 
released to the public, that indicates that the 
information is closely held. The sources of 
information and information. That would be our 
position. 

THE COURT: Does the government agree it's 
a fact finder question? 

MR. MORROW: Yes. 

THE COURT: The defense agrees it ' s a fact 
finder question? 

MR. COOMBS: Yes, Your Honor. 

THE COURT: And I would be interested in 
and seeing the case for prong one, but I'm also 
thinking for prong 2 the cross-examination from the 
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government did go into what was highlighted, came from 
government sources and what didn't. For that reason 
alone, I'm looking at how — without admission of those 
documents, I don't have any idea what came from 
government sources and what didn't. 

MR. MORROW: Well, based on Colonel Davis's 
answers, the government's position is that with respect 
to the detainees, none of it came from sources lawfully 
available to the public. So if there was stuff on the 
Internet, statements made, a movie... 

THE COURT: The defense has proffered that 
this is admissible based on the cross-examination, I 
presume? 

MR. COOMBS: Yes, Your Honor. 

THE COURT: Under MRA703. 

What ' s the government ' s position with 
respect to that? 

MR. MORROW: One moment, Your Honor. 

Obviously, as the court's a fact finder, 
they can address the weight of the evidence, in which 
case we still contend that the use of sources just 
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willie-nillie off the Internet would be more 
prejudicial to the government. 

THE COURT: All right. I think I can use 
the evidence for its proper purpose. Just to move 
things along before we get to the case, under prong 
two, under the closely held and based on the 
cross-examination, I'm going to go ahead and allow it. 

MR. MORROW: Okay. Thank you, Your Honor. 
MR. COOMBS: Your Honor, just a brief 
foundation for the evidence. 

DIRECT EXAMINATION BY MR. COOMBS: 
Q I'm handing you what ' s been marked as 
exhibit alpha-alpha for identification. 

Can you just glance at that for a moment 
and tell me if you recognize that? 
A (Witness complied) . 

Q What is that, in general terms? 
A It ' s the binder of publicly available 
information related to the three closely related 
detainee assessment briefs. 

Q And are there highlighted portions within 
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this binder? 

A Yes. 

Q And who made those highlights? 
A I did. 

Q Are there also tabs, basically, for — 
within the binder? 
A Yes. 

Q And who put those tabs in? 
A I did. 

Q What do those tabs signify? 
A Obviously, it ' s a fairly thick document. 
The pages where items were marked. 

MR. COOMBS: I'm retrieving exhibit 
alpha-alpha for identification from the witness and 
moving as exhibit alpha-alpha for identification into 
evidence as defense exhibit alpha-alpha. 

THE COURT: All right. Government, I heard 
your objection. I basically overruled it. So defense 
alpha-alpha is admitted. 

MR. MORROW: And, Your Honor, if the same 
foundation will be laid for all three, we'll stipulate 
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to that. 

THE COURT: So I assume it's bravo-bravo 
and charlie-charlie? 

MR. COOMBS: That is correct, Your Honor. 
So for each one of these, Colonel Davis would identify 
the documents as being the open source for respective 
DAV and also that the highlights that were made within 
these documents were made by him as well as the tabs 
that were placed there were placed there by him. 

THE COURT: All right. Let me see them and 
I ' 11 admit those as well . 

MR. COOMBS: Your Honor, no further 

questions . 

THE COURT: Okay. 

MR. MORROW: One moment, Your Honor. 

(Pause. ) 
Nothing further. 

THE COURT: All right. Temporary or 
permanent excusal? 

MR. COOMBS: Permanent, Your Honor. 

THE COURT: Mr. Davis, you are permanently 
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14 

excused. You are free to go or you can stay in the 
courtroom. 

THE WITNESS: Thank you. 

MR. COOMBS: The defense calls Mr. Cassius 

Hall. 

MR. MORROW: Your Honor, for the record, 
I'm leaving the courtroom. 

THE COURT: And that would be for the 
record, Captain Morrow? 

MR. MORROW: Yes, ma'am. 

(Mr. Morrow left courtroom.) 

Whereupon, 

CASSIUS HALL, 

called as a witness, having been first duly sworn to tell the truth, 
the whole truth, and nothing but the truth, was examined and testified 
as follows: 

MS. OVERGARD: You may be seated. 
And you are Mr. Cassius Hall of INSCOM at 
Fort Belvoir, Virginia? 

THE WITNESS: I am. 
EXAMINATION BY MR. COOMBS: 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 07/09/13 Afternoon Session 



Q Mr. Hall, you are a security specialist 
subject matter expert with INSCOM; is that correct? 
A Yes, sir. 

Q And INSCOM is the Intelligence and Security 
Command? 

A Yes, it is. 

Q Now, you were assigned as a security 
subject matter expert for the defense in this case? 
A Yes, in August 2010. 

Q And how were you selected to act as the 
defense security expert? 

A Well, the tasking came down to our command 
and my director called me into the office and she said 
it related to a lot of classification and ensuring that 
documents were identified correctly, marked correctly. 
So by me being the classification advisory officer for 
INSCOM, I was selected for the task. 

Q Are you knowledgeable on the job of a 35 
fox and intelligence analyst? 

A Well, at the time when I was a United 
States bravo I'll say yes, I am. 
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Q So the MOS has changed from a 96 bravo to a 
35 bravo? 

A Yes, I think they made a conversion. I 
believe — I think it was in 2007 but essentially it's 
the same thing. 

Q Did you review the charge SigActs in this 

case? 

A I did. 

Q And did you review the classification 
review of the SigActs by Vice Admiral Robert Harwiggen 
(phonetic) ? 

A Yes, I did. 

Q Mr. Hall, are you prepared today to tell us 
about the duty position of a 35 fox and the charge 
SigActs? 

A I am. 

Q Let's begin by discussing your general 
background, okay? 
A Okay . 

Q Again, you are a security expert? 
A I am, sir. 
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Q How long have you been in your current 
position with INSCOM? 

A Well, I accepted the position with INSCOM, 
I believe it was, April of 2008. 

Q So roughly about four or five years? 

A About five or six years now. 

Q And how did you become the security expert 
with INSCOM? 

A Well, I was hired based on my years of 
experience and, of course, the job had indicated that 
they were looking for someone with intelligence 
background also. So I fit into that category and then 
some schools that I have had and basically that was it. 

Q Now, have you ever been in the military? 

A I have, sir. 

Q And how long were you in the military? 
A Roughly around 22 years. 

Q And you earlier said your MOS was 96 bravo. 
Was it a 96 bravo for the entire time? 
A Yes. 

Q And can you briefly tell the court some of 
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your previous positions when you were in the military? 

A I started off on the tactical side. My 
first assignment was with (inaudible) Fulda Gap in 
Germany. I then left there and I graduated and moved 
up to what we call strategic and my 513th which was 
based out of a Fort Mott, New Jersey. During the time 
of the 513th, I had operation Just Cause, went to 
Desert Storm I, numerous training opportunities which 
is keeping up on your skills . They were sending me a 
lot of places. 

I then left there and went back to the 11th 
ACR in Germany where I served as the S2 OIC. I then 
left there, did a cut and went down to K'town, 
Kaiserlautern, also in Germany, where I was the ANIC of 
the G2 . I left there and went to Fort Huachuca and 
took a special assignment, the ACRC program. I did 
that and then I finished my career at Fort Myer. 

Q What year did you retire from the military? 

A End of 2004. 

Q And what was your rank at the time of 
retirement? 
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A I was a master sergeant. 

Q What did you do after retiring? 

A I then applied for a job there at Fort 
Myer. They needed an intel person. So I became the 
chief of the security and intel branch which was a 
small branch where I handled information security and 
then I started as the liaison to the IC community. 

Q And can you explain to the military judge 
kind of a normal day in that position as the chief of 
security and intel division for Fort Myer? 

A Ma'am, on a normal day we handle 
information security. I had another guy that worked 
for me handling the personnel security and conducted 
the background checks. A lot of my job included going 
and doing meetings with the IC community, keeping up on 
the thread. 

Any time there's a contingency mission, as 
you know, Murray handles a lot of VIPs. So I was 
getting all the intel information as well as supportive 
and enforcement protection officer who was actually the 
operation officer with all the incoming intel 
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information identifying any threats and stuff. 

Q And how long were you in position of chief 
of security in intel division at Fort Myer? 

A About four years. 

Q And where did you go after that position? 

A I then accepted a position with INSCOM G2 . 

Q And within your job at INSCOM, what do you 
do as part of INSCOM? 

A I'm assigned to the intelligence and 
security division which is located at G2 of INSCOM. 
Within INSCOM, we handle oversight of all of our MSCs, 
our units around the world, anything under information 
security, whether it's — based on my level, we handle 
the policy, creating the policy, doing oversight of 
inspection. I also handle the classifications for 
INSCOM. 

Q What do you mean by classification for 
INSCOM? 

A I am the classification advisory officer 
which is my primary job and I handle, basically, a lot 
of security classification guides and I think we have a 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 07/09/13 Afternoon Session 



total of 19 or 20 security classification guides. I 
review the security classifications. I have to ensure 
that they're up-to-date within the five-year review. I 
put them together and any new guides created. I put 
all the information together, review all of the 
information and then I take them to the CG for 
signature . 

Q Are you authorized in your position to 
declassify documents? 

A I am. We have authority from the CG to the 
classification officer that we declassify documents. 

Q In general, how often do you declassify 
documents in your position? 

A It depends. Usually the declassification 
documents may come down to FOIA. We manage to get a 
call in, someone inquiring about a document and we send 
them to our PAO office. Most of the time it comes from 
FOIA. And when it comes down, I review to see if that 
document can be declassified to tell you that — by 
working in the intelligence community, a lot of that 
information contains sources and methods . So we never 
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release sources and methods. 

Q All right . Let ' s talk some more about your 
current position. 

In your position, do you teach at all? 

A Yes, some of the MSCs, they will request 
that we come out and give a classification class, 
current classification. So we would go out to the MSCs 
and we would do an overview of document instructions on 
declassification. We try to do that quite often. But 
we rotate amongst our team because we were all trained 
and qualified to do that. 

Q How many years in total have you been 
handling classified information? 

A About 28. 

MR. COOMBS: Your Honor, at this time, we 
tender Mr. Hall as an expert in the job of an 
intelligence analyst and handling classified 
information. 

THE COURT: Where are you going with this? 
MR. COOMBS: Your Honor, we intend to 
describe the job of intelligence analyst and his review 
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of the SigActs and comparing the SigActs with the open 
source . 

THE COURT: Are you going to ask an 
ultimate opinion as we did with Mr. Davis? 

MR. COOMBS: No, Your Honor. 

THE COURT: Any objection? 

MS. OVERGAARD: One moment, please, ma'am. 

THE COURT: While they're conferring, can 
you name those expertises again? 

MR. COOMBS: Yes, Your Honor. As an 
intelligence analyst, he served 22 years as an 
intelligence analyst. And as handling classified 
information, he has done that for 28 years. 

(Pause. ) 

MS. OVERGARD: The government would just 
object to the broadness of it. Maybe if it was 
narrowed more for reference to his testimony. 

THE COURT: Let's do this. I'm going to — 
I'll accept the expertise. If we start getting way far 
afield, I may revisit this, but go ahead. 

MR. COOMBS: Thank you, Your Honor. 
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BY MR. COOMBS: 

Q Mr. Hall, let's turn to what you did in 
this case, why you did it and how you did it. Okay? 

A Yes, sir. 

Q All right. First, can you tell the court, 
generally, what you did in this case? 

A Ma'am, I was tasked to review the charge 
SigActs. I think it's specification 5 and 7, charge 2, 
to review for proper classification to see if they was 
classified properly in (inaudible) 1 through 5 through 
6. I reviewed the damage assessment, I think the DIA 
and I reviewed the OCA's classification review. 

Q And why did you review the charge SigActs 
in this case? 

A Well, I reviewed, first thing, to see if 
they was properly classified, of course with the 
executive order and then we was tasked to do so. 

Q Now, how did you conduct your review of the 
charts against — 

THE COURT: Let me just ask you before you 
get there. You were tasked to do so by who? 
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THE WITNESS: By Mr. Coombs. 
THE COURT: Okay. Go ahead. 
BY MR. COOMBS: 

Q And how did you conduct your review of the 
charge SigActs? 

A We individually reviewed the charge SigActs 
and then compared them again with the OCA ' s 
determination . 

Q Did you review all of the SigActs or just 
the charge SigActs? 

A Just the charge SigActs. Not all of them, 
just the charge SigActs. 

Q And how many SigActs, approximately, did 
you review? 

A I believe there's 102. 

Q And what did you do after pulling the 
charge SigActs and comparing them with the 
classification guide? 

What else did you do? 

A Again, pull the SigActs, to look at them 
and to get any type of identifying data that we could 
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use to do a search on the open domain. 

Q And before we get to your open source 
search, did you review the OCA's classification 
determination? 

A Yes, I did. 

Q And why did you review that? 

A Just reviewed to see if it was in 
accordance with the executive order and it was. 

Q And with regards to the open source 
information, can you explain what you mean by open 
source information? 

A Well, it's anything that's available to the 
public. Anybody can do a research on the Internet and 
pull it up. 

Q And did you do any sort of date restriction 
for your open source? 

A We did. Anything — we set the filter on 
anything prior to the release of the leak. 
THE COURT: Prior to? 
THE WITNESS: The release of the leak. 
BY MR. COOMBS: 
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Q So if I'm understanding you correctly, 
everything that you found from open source predated the 
release of this — of the charge information? 

A Yes. If one of the SigActs was dated, say, 
in June of '07, then anything prior to that we 
researched. 

Q Now, before we talk about the results — 

THE COURT: Wait a minute. So explain that 
to me again. The SigAct is dated in 2007? 

THE WITNESS: As an example, say if the 
date of the SigAct was June 2007, then I would restrict 
the filter to 2007 and prior. So I think we went back, 
like, two years, 2007 to 2005. 

THE COURT: The date of the release of the 
information or the date of the SigAct? 

THE WITNESS: The date of the SigActs, 

ma ' am. 

THE COURT: Okay. Go ahead. 
BY MR. COOMBS: 

Q Now, before we talk about that and what the 
results were, I want to ask you a few questions about 
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SigActs in general. Okay? 
A Yes, sir. 

Q Now, in general, what information is 
reported in a SigAct? 

A A SigAct is a quick snapshot of the 
information that ' s ongoing at that point in time . So 
it's information that one observes, a significant event 
that is reported up the chain. 

Q And in this case, did any of the charge 
SigActs contain anything like photographs, videos or 
other reports or was it just a snapshot of the 
information that happened at the time? 

A It was just a snapshot of information. 
There was no photographs or anything else. 

Q And can you explain how an intelligence 
analyst, a an 6 bravo in your day and a 35 fox 
currently might use a SigAct to create a work product? 

A Well, since a SigAct is briefly just — 
it's not detailed information. It's just a quick 
snapshot of what has occurred. 

You would take that information, research 
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other databases that you can pull from the intel 
community or whatever is readily available. Then you 
would incorporate this information and produce 
intelligence product. So you would basically have 
multiple sources when you create this product. 

Q So how does an intelligence analyst create 
their product? 

A Well, there's numerous ways but the way to 
create is that you would take all of this information, 
you would put it together you would basically vent 
information to be sure that you are getting the right 
information and it ' s from a good source . 

A lot of times you may not have a good 
source or the information that not be as good. So, 
therefore, you need that information to put it together 
and then, when you do that, you create an intelligence 
product or an intelligence briefing that you're going 
to be giving a commander. 

Q And can you provide the court with a 
hypothetical example of an intelligence product? 

A We use MSRs all the time which is the main 
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supply route. So you could actually — the enemy 
that's on a main supply route, what do they pose? What 
does the enemy pose on a main supply route? 

Q Mr. Hall, did you prepare a visual aid to 
assist your testimony? 

A I did something similar to that. 

Q Mr. Hall, I'm showing you defense 
delta-delta for identification. 

Do you recognize that? 

A I do, sir. 

Q What is that? 

A This is the example that I created. It's 
basically an example, four months of information put 
together . 

Q Now, is this an actual — based upon actual 
SigActs? 

A No , it ' s not . No . 

Q So this is just a hypothetical? 

A This is an example I want it to be. 

MR. COOMBS: Retrieving defense exhibit 
delta-delta for identification. 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 07/09/13 Afternoon Session 



Your Honor, permission to publish? 
THE COURT: Go ahead. 
BY MR. COOMBS: 

Q Mr. Hall, if I could, I'd like to kind of 
go through this slide a little bit. 

Would this help you in your testimony? 
A Yes, sir. 

Q What does this diagram detect right here? 
Can you kind of walk us through it? 

A Well, as in any briefing of a map, you have 
the legend, of course, and then you've got the month in 
the right-hand corner. That's broken down. So this 
represents the first month of information that you 
would get from your database, whether it be SigActs or 
some other type of database that the unit or agency may 
be keeping. 

Q And with regards to the town 1, town 2, 
town 3, what are those towns along on the map? 

A They are along the MSR, which is the main 
supply route. So I did 1 and 2 and 3 just to represent 
the towns that show something significant on there and 
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then the symbology for the other items . 

Q And when you say symbology, that's the 
legend as far as what type of attack? 

A Right . You have some where you have an 
attack on the base and then the ambush. So what you're 
trying to do is you're trying to get a pattern analysis 
of what is actually going on on the MSR. 

So you would want to use more than one 
month. The commander may say, hey, within the last 60 
or 90 days I need to know the activities that has been 
ongoing on the MSR. So you can't use one month or one 
day because that doesn't given him anything. You have 
to use more than that to give him the big picture. 

Q And so — if I could, I want to show you — 
for example, if we go to month 2, now again, here, how 
did you change month 2 from month 1, just in general? 

A How did I change it? 

Q Yeah. 

A Oh, you'd add more activity. That's why 
town 2 is circled. 

Q Okay. So, as you said, you would do 
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multiple months of information with apparently marking 
where certain attacks occurred during that month? 

A Right. You want to show him where the 
attacks are happening along the MSR so he would be able 
to make a calculated decision in reference to convoys 
going on in the future. 

Q Now, is it easy for an analyst to just take 
information and plot it on the map? 

A Well, I would say it's probably easy from 
the plotter, but they have to know what they're 
plotting and how they're going to plot it. 

So I would say yes, it's easy for them to 
do the research. But, first of all, they gotta know 
what they ' re researching in order to get the correct 
information and plot it on map, they'd have to know 
where to the plot it and the symbology to use. So, 
yes, they could. 

Q And based upon this, like, if you were — 
you know, had just gone through month one and finally 
month four, if you were showing these four months on a 
PowerPoint slide presentation to a commander, what 
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would, then, an analyst use these diagrams in order to 
advise the command on? 

A What would he use? 

Q The diagrams. Like, what would you use 
this information, then, to tell the commander? 

A Well, you would tell — I mean, basically, 
do a predictive analysis on everything. You would give 
him what we expect the enemy to do, the enemy's course 
of action. 

Q And how would you make predictive analysis 
based upon the stuff that you plotted on a map? 

A By doing an analytical review of all of it, 
plus when you develop a pattern analysis, you get a 
tree-in (sic) and with the tree-in you can identify 
what's going on along the MSR. So when you brief the 
commander, then you're basically telling him this is 
what we believe. 

Q And what would a commander — once the 
commander gets that information, what would a commander 
use that information for? 

A Well, he needs to use it to adjust his 
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operations people going on the MSR so he can adjust his 
course of actions. 

Q And the predictive analysis that you're 
talking about, is that as easy to do as just plotting 
points on a map? 

A Yeah, you've got to be in for a while and 
have some good leadership and training in order to have 
that done. Coming out of AIT just being a couple of 
years within the military you can't — as an analyst, 
you couldn't do it. 

THE COURT: Can I ask a question before you 
move on? With that months one through four, is that 
month one the recent month or month four the most 
recent month? 

THE WITNESS: Yes, ma'am. Month four would 
be the most recent one. 

THE COURT: So that means each month is its 
own compilation or is month two the compilation of 
months one and two? 

THE WITNESS: Right. Month two has — it's 
showing the trans of month one as we started off, month 
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two, you add more to it and month three and then four, 
the final is the cutoff. 

THE COURT: It's the accumulation of all 

four months? 

THE WITNESS: It's the accumulation of 
everything. So you gotta have that in order to give 
the commander the big picture. 
BY MR. COOMBS: 

Q Now, let's talk about the open source 
research that you conducted on the charge SigActs in 
this case. Okay? 

A Yes, sir. 

Q How did you find your open source 
information again or they charge SigActs? 

A Well, what we did basically did is that we 
used Google and we went on and we did a restrictive 
date and then — 

THE COURT: We did? 

A Restrictive date, as I stated earlier, and 
then identified a couple of key words within the 
SigActs and then punched it into Google. 
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Q And did you find open source for every 
SigAct? 

A No , no . 

Q How many SigActs did you find open source 
information for? 

A I think it was 60 or 62, but it wasn't 
detailed information. Just keep in mind SigActs is not 
a detailed report. 

Q Now, the SigActs that you couldn't find 
open source information on, in general, what were those 
SigActs about? 

A As I recall, I think they was about IEDs, 
small arms, fire. Might have been something if a 
telephone call was received or incoming, as I remember. 
I don't know. 

Q Now, the ones that you did find open source 
information about, in general, what type of open source 
information did you find on them? 

A What kind? 

Q What type? Like, were they news stories, 
were they government releases? 
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A They was, like, news stories. In other 
words, if a soldier was KIA or WIA, you would find 
that. That's in there, what I came across. 

Q All right. And how did you capture the 
open source information that you found? 

A I went on and did the search and we kept 
information. We created a database for a further link 
that went with the SigActs and then we printed — I 
printed it off and then I compared it with the actual 
SigActs . 

Q And once you printed off, I guess, the open 
source, what did you do with that? 

A Reverified it, read the SigActs along with 
the open source to see what type of information that 
the open source contained, that the SigActs contained 
and then I highlighted the open source. 

Q And based upon that information that you 
found, did you reach any general conclusions about the 
amount of open source information for the SigActs? 

A We came to a conclusion? 

Q Yes. 
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A Well, a lot of the information that we did 
research on, you know, you can find it in the open 
source. But it wasn't detailed information, no. It 
was information — it wasn't a complete paragraph or a 
complete sentence, I don't believe. They just gave a 
brief description. Like, if a soldier was killed in 
Afghanistan, it had the soldier's name, but you can 
find that basically on DOD open website too. 

Q Now, Mr. Hall, have you ever worked for 
CentCom? 

A No, sir, I have not. 

Q Does your job require you to review 
information from CentCom? 

A No, but I will review information if 
CentCom had equities within their information and I 
have done that on many occasions. 

Q Are you an original classification 
authority? 

A No, sir, I 'm not . 

Q Have you ever been an original 
classification authority? 
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A I have not . 

Q In your field, would you publicly disagree 
with an original classification authority? 
A Would I? 
Q Correct . 

A The OCA's decision is binding. So when we 
deal with classified information, it always states that 
you always refer back to the OCA because it's not 
information that belongs to the OCA. 

Q In this instance, are you disagreeing with 
the OCA that reviewed the charge SigActs? 

A No, sir. 

Q If you're not disagreeing, what are you 
doing then? 

A If I don't agree with his decision, I mean 
his decision — as I stated earlier, I used the example 
of a command of the first sergeant. You may disagree 
with something when you ' re behind closed doors , but the 
commander says this is what I want. So you drive on. 
So I don't have — it's not our information, so... 

Q And did I request that you give a 
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classification determination on the SigActs? 
A No. 

Q Mr. Hall, I'm showing you what's been 
previously shown to the government as exhibit whiskey 
for identification. 

Can you review that for a moment? 
A (Witness complied.) 

Okay. 

Q Do you recognize that? 
A I do. 

Q And, in general, what is it? 

A It's one of the SigActs that I reviewed. 

Q And does this SigAct contain any 
highlights? 

A It does . The information that I 
highlighted that — basically what I found when I did 
the research and open source. 

Q And how did you determine what to highlight 
on that SigAct? 

A I compared it with the open source 
document . 
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Q Did you also highlight the open source 
document? 

A Yeah, I did. I compared them both, put 
them side-by-side. 

Q I'm now showing you what ' s been marked as 
defense exhibit x-ray for identification previously 
shown to the government. Take a look at that. 

A (Witness complied.) 

Okay. 

Q And do you recognize that? 
A Yes, sir. It's another SigAct that I 
reviewed. 

Q And does that SigAct contain highlights? 

A It does, information that I highlighted 
compared to what was found on the open source. 

Q And did you also make similar highlights in 
the open source? 

A Uh-huh, I did. 

Q And you said that you did a review of all 
the 100 SigAct s. 

For how many SigActs, again, did you find 
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open source information? 

A I think it was 60 or 62, sir. I believe it 
was 62, I believe. 

Q Thank you. 

MR. COOMBS: I'm retrieving the exhibits 
from the witness. At this time, the defense offers 
defense exhibit whiskey for identification into 
evidence as defense exhibit whiskey. And defense 
exhibit x-ray for identification into evidence as 
exhibit x-ray. 

THE COURT: Any objection? 
MS. OVERGAARD: One moment, please, ma'am. 
(Pause. ) 
No , ma ' am . 

THE COURT: Defense exhibits whiskey and 
x-ray are admitted. 

MR. COOMBS: No further questions. 

THE COURT: Cross-examination? 

MR. FEIN: Your Honor, the United States 
asked for a recess so we can review these highlighted 
documents we've never seen before before we start 
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cross-examination . 

THE COURT: How long do you think you'd 

like? 

MR. FEIN: 20 minutes, ma'am. 

MR. COOMBS: Your Honor, we have two 
similar documents for Mr. Ganiel. So maybe the 
government can use this opportunity to look at those as 
well . 

THE COURT: Do you need additional time or 
do you think 20 minutes is sufficient to look at all 
four of the documents? 

MR. FEIN: Ma'am, if we can go for 20 and 
look at it and figure out what's the next step because 
he also testified that he reviewed others documents . 

So we're either going to have to go through 
our discovery and find where it was or we ' 11 ask the 
defense and we'll do this later about getting copies of 
the binders so we can look at it. 

THE COURT: If there were similar binders 

that are — 

MR. COOMBS: There are, Your Honor. 
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THE COURT: Okay. Why don't we — let's 
try to be a little expeditious here and show the 
government what they are with the highlighting. 

MR. FEIN: We will, ma'am — we'll do 30 
and we'll keep the court updated in the 30s and up. 

THE COURT: All right. That's just for all 
the documents and all the binders? 

MR. FEIN: Yes, ma'am. 

THE COURT: All right. That works. The 
court is in recess, then, until — before I put it in 
recess, Mr. Hall, please don't discuss your testimony 
or your knowledge of the case during the recess and the 
court is in recess until 14:35 or 2:35. 

(Court went into recess at 2:07 and the 
trial resumed at 3:14 p.m.) 

THE COURT: Please be seated. The court is 
called to order. Let the record reflect all parties 
present when the court last recessed are again present 
in court. The witness is on the witness stand. 
Proceed. 
BY MR. COOMBS: 
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Q Mr. Hall, I just wanted to ask a question 
to clear up maybe a little bit of confusion that I 
might have had with my question to you. 

A Yes, sir. 

Q And that is: When you did your open source 
research review, what date or what period of time did 
you start your open source research and go back? 

A For the SigActs, correct? 

Q Correct . 

A Researched the date prior to the release. 

Q And when you say release, are you saying 
the release of the charge information, the release by 
Wikileaks? 

A Right, release from Wikileaks. 

Q All right. So it predated the release from 
Wikileaks back to the date of when the actual SigAct 
occurred, that would be open source information that 
you were looking at? 

A Right. If the release from Wikileaks was 
on the 10th, then we did a search on the 9th prior. 
MR. COOMBS: Okay, thank you. 
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THE COURT: Before I turn you over to the 
government, I just want to ask you that. Just to make 
sure I'm clear because I thought I asked you that 
before and got a different response. 

The date of the SigAct search, the date of 
when the release was from Wikileaks back to the date of 
SigAct, is that what your response... 

THE WITNESS: I got confused. I mean, we 
did a lot of research from the date that it was 
released from Wikileaks. 

THE COURT: Okay. 

THE WITNESS: So, say it if was released on 
the 10th, then we did a restrictive search on the 9th 
and I think we went back maybe two years . I don ' t 
remember the exact date. So say if it was released 
from the 10th from Wikileaks, then we did a restrictive 
search from the 9th of June prior. 

THE COURT: Okay. So let's say the release 
was in January of 2011. 

THE WITNESS: Yes, ma'am. 

THE COURT: And the SigAct was in 2006. 
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You would have gone from — 

THE WITNESS: Right, we went back to the 
date of the SigActs. 

THE COURT: So what's the two years? 

THE WITNESS: Well, some SigActs, I think 
it was about 2009, I believe, as I recall. But I don't 
remember seeing the SigActs from 2011. It may have 
been, I don't know. But we covered the date from the 
date of release to the Wikileaks past the actual date 
of the SigActs. 

THE COURT: Okay. So you went back to the 
date — so each search, then, was different depending 
on the date — 

THE WITNESS: Yes, ma'am. 

THE COURT: Okay, thank you. 

Government? 

MR. FEIN: Can I have a quick moment, Your 

Honor . 

THE WITNESS: Yes (Pause.) 
CROSS EXAMINATION BY MR. FEIN: 
Q Mr. Hall, could you please explain for the 
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court what your general duties are? 
A Start over. 

Q Mr. Hall, could you please explain for the 
court what your general duties are and your role at 
INSCOM? 

A My general duties, ma'am, as I stated 
before, that I'm a classification advisory officer on 
the security division team. We go out and we do 
oversight, inspecting all of our units. I usually 
handle the information side which covers everything 
from classification, safe management, SOPs, policies, 
and then, as I stated, we handle some of the training 
when requested by the MSCs. 

Q And the commander of the U.S. Army INSCOM 
is an original classification authority? 

A Yes, sir, he is. 

Q And he currently, or she, before had 
delegated the declassification authority to the Army 
G2? 

A No, INSCOM G2. 

Q I'm sorry. Thank you. The INSCOM G2? 
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A Yes, sir. 

Q And the INSCOM G2 was your boss? 

A Right, Mr. MacAleary. 

Q And when you did any type of 
declassification reviews, you were doing that for the 
declassification authority, the INSCOM G2? 

A Yes, sir. 

Q And you did those reviews based off of 
INSCOM owned information, correct? 
A Roger . 

Q And what did you do when you received 
information, classified information, that did not 
belong to the United States Army that may come into the 
DRU unit within the Army? 

A Oh, we would sent it back up and let them 
know. I mean, we could call — say if it belonged to 
CentCom, we would call CentCom and say, hey, you got 
some information, let's task it. I came down for 
declassification and you called the OCA and then it 
would go back through the channels and then they would 
forward it to CentCom because we can never touch 
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anybody else's information. 

Q And who is the best position to evaluate 
whether information should or should not be 
declassified? 

A You're talking within INSCOM? 

Q Within the structure of classification. 

A The OCA, sir. 

Q Okay. And that's why you, for INSCOM, 
didn't review CentCom owned information? 
A Right . 

Q That's why you gave it to INSCOM or, excuse 
me — I apologize. That's why in your scenario, you 
gave it to CentCom? 

A Yes, sir, absolutely. 

Q Because CentCom it best suited to review 
CentCom information? 

A Absolutely, because it's their information 
and it belongs to them. 

Q And if it was a three letter federal 
agency, it goes to them? 

A It goes to them, whether it be the FBI, 
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DIA, CIA. Absolutely right. 

Q Whoever it is, it goes to them because 
they're the best suited to make those determinations? 

A Right. We're basically forbidden to touch 
another OCA's information. 

Q Now, what if an individual believes, who 
handles classified information, that something 
shouldn't be classified? 

Is there a process in place for them to 
seek clarification? 

A If you believe that it ' s not classified? 

Q If a document is marked secret, but the 
individual believes it should not be handled as secret, 
is there a process in place for that individual to seek 
clarification? 

A Yes, there is. There's a challenge 
process, but you have to go through the appropriate 
channels. You still have to protect the information as 
marked whether it's secret, TS or confidential. Until 
you go through the formal process of a challenge to 
say, hey, I think that this information may be 
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incorrectly marked or it could be — needs to be 
remarked. Now, there's a process by the regulation and 
you have to go through that process in order to get a 
validation. Basically, it goes back to the OCA or the 
OCA representative and if they say the information is 
secret, then that's the end of it. 

Q And that regulation is AR380-5? 

A Roger . 

Q And that ' s based off of executive order 
13526 — 

A And it's also in DOD manual, 5200. 
Q Which is the parent manual for 380-5? 
A Yes, sir. 

Q And to just talk about that process for a 
little bit, if an individual at the user level — so 
from your time as an intelligence analyst or us now 
here, we would then — you would have a document that's 
marked secret, correct? 

A Roger . 

Q And then we would take that document and 
give it through our technical or security chain? 
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A Yes, sir. 

Q And that would go up through the security 
chain to be processed to determine whether it is or is 
not secret or something else? 

A Roger . 

Q And then it would go up through our chain 
of command? 

A Roger . 

Q And then it would go, then, laterally at 
some point to the owner, the OCA? 
A OCA, roger. 

Q And then the OCA would then review it and 
make a decision whether it was properly marked or not? 
A It always has to be referred back to the 

OCA. 

Q And there ' s even a process in place if two 
OCAs disagree, correct? 
A Absolutely. 

Q The dispute process under executive order? 
A Exactly . 

Q And there's a federal entity that's above 
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all on the executive branch to step in if needed 
between classification decisions? 

A Roger. That seldom ever happens. 

Q Because it's resolved by the OCAs? 

A Yes, sir. 

Q And during that whole process a user of 
classified information, authorized holder, is required 
to treat it as secret, correct? 

A That's protected at all times at the level 
that it ' s marked . 

Q And that's true if it's on a computer? 

A Yes, sir. 

Q That's true if it's on a CD? 
A Yes, sir. 

Q That's true if it's printed? 
A Yes, sir. 

Q Mr. Hall, you testified earlier that you 
reviewed the charge SigActs for the CIDNE A and CIDNE I 
databases, correct? 

A Specification 5 through 7, charge 2. 

Q Even more precise than I am. 
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And you did that based off key words you 
found when scanning through the documents? 

A Right. It would be a key word, you know, 
if KIA or WIA was killed and it had his last name in 
there, going to the Google search, punch in his last 
name and Afghanistan or the unit, it just comes up. So 
usually the first report or the second report. I did 
no more than three. 

Q And you ' ve used your experience with saying 
that the term KAI on its own is not classified, so you 
could put that in Google, correct? 

A Right, KAI wouldn't be classified. 

Q But you, when doing that process, you 
didn't just choose any word on the documents and 
SigActs? 

A No, no, no. 

Q You chose obvious words that are doctrinal 
in nature that you knew were unclassified? 
A Roger . 

Q And when you did that, you found various 
open source information that included that specific 
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term you looked for? 

A Right. If I did a search on a KIA, it came 
back — it may have came back with an individual ' s 
name, 101st airborne division and blah-blah-blah. But 
there was nothing detailed, sir. 

Q And when you did that, you didn't find any 
actual SigActs that came back? 

A No. 

Q Any SigAct as they're found in the CIDNE 
database? 

A No, sir. 

Q You just found some information from some 
of the SigActs in the open source? 
A Roger . 

Q Now, when you reviewed the SigActs, did 
they have a classification marking? 
A Yes. 

Q And that was all the charge SigActs that 
you reviewed? 

A Roger, top and bottom. Most SigActs is a 
paragraph marked. 
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Q So there were no paragraph markings? 
A No, sir. 

Q And that is a common occurrence for 
deployed units doing reporting, correct? 

A Absolutely, because it's just a quick 
snapshot of the event that ' s taken place and from the 
ground soldier in the infantry, you're just getting a 
quick snapshot of the information of the event that ' s 
happening and then they send it back up the chain. 

Q But the rules do require paragraph 
markings? 

A Yeah, further down the line when it's more 
detailed and they get a chance to go through it and 
edit it. 

Q Okay. And this — the SigActs, to the best 
of your knowledge and experience, were put on SIPRNET? 
A The ones that I reviewed? 
Q Correct . 

A I believe so, sir. I don't know. I 
thought they was inside of the CIDNE database. I don't 
know. 
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Q Okay. So from CIDNE database, you don't 
know if CIDNE was on SIPRNET or not? 

A No, I have no idea. That's a system that 
belongs to CentCom. 

Q And in your experience CIDNE actually 
postdates your experience in the Army? 

A Correct . 

Q But not necessarily the concept of SigActs? 
A Roger . 

Q When you did your open source analysis, you 
didn't find any analysis or commentary about the 
information within the SigActs? 

A No, sir. 

Q When you did your open source analysis, you 
didn't find any specific identifying information that 
would identify those actual SigActs? 

A No, sir. 

Q But you did — for example, you did find 
open source information about KAIs or WIAs? 

A Yes, sir, and don't I think — probably by 
some rule or regulation you don't have to report to KIA 
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or WIA. So once it goes into the media, you just log 
in. You go on Google search and you're probably going 
to find something regardless. 

Q For instance, you found U S. government 
official sites that released KIA names, maybe their 
hometowns, their mission and even a general description 
of how they possibly were killed? 

A Yes, sir, uh-huh. 

Q But that website nor any other website 
explained the details of how our soldiers were killed 
in battle? 

A Right, there was no detailed information. 

Q No details like the TTPs that the units 
were following, how the ID was in place? 

A No, sir. Not at all. 

Q And with prosecution or — excuse me, 
defense exhibits whiskey and x-rays, the two SigActs 
you reviewed and highlighted, the highlights weren't 
verbatim, correct? 

A No, they were not. 

Q They were just your best guess based off 
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what you found in open source? 

A You may have had one or two words that was 
the same, but nothing else. 

Q Okay. So when those highlights might — it 
was your best estimate that this information in defense 
exhibit x-ray or whiskey was similar to this 
information you found? 

A Yes, sir. It may have been worded in a 
different way. 

Q So it could say water bottle on a podium 
and then you found something that said a container 
holding water on a table? 

A Roger . 

Q That's what you highlighted? 
A Yes, sir. 

Q And for both of them, the total number of 
highlights probably, you would estimate, would be less 
than five percent of the SigAct? 

A Roughly , right , five percent . 

Q And that's sort of just two SigActs? 

A Right, that I highlighted just for the 
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court ' s — to show an example . 

Q But you did find other information in other 
SigActs you reviewed? 

A Yes, sir. But as I stated, nothing was 
detailed because the SigAct is not meant to be 
detailed, it was just the one of the tools of 
information that you may find. That's all, nothing 
more. 

Q And you testified earlier about your 
experience as a senior non — well, really, your entire 
experience as an intel analyst for the Army as a green 
suiter? 

A Yes, sir. 

Q You retired as a master sergeant? 
A Yes, sir. 

Q You had a lot of experience and analysis 
from the tactical to strategic levels back and forth? 
A Yes, sir. 

Q You testified that intel analysts learned 
how to do pattern analysis? 

A I don ' t remember saying that . I thought I 
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was asked — I mean, I stated that they have to learn 
how to do pattern analysis and, when they get to a 
certain point, you do analysis at an early age in your 
career, I mean, you're not seasoned enough to do that. 

Q So all intel analysts learn about pattern 
analysis and how it ' s used, but we don ' t rely on junior 
analysts to do pattern analysts until later in their 
career? 

A It's your job doing a lot of research, 
learning how to research. But in order to be an 
effective analyst you gotta know what information and 
research it should be specifically driven — not 
driven, but specific on information that's requested is 
as well as you know, I mean, the PIRs is what runs the 
commander's intel mission. 

Q And what are PIRs? 

A Priority intelligence requirements . 

Q And can you explain — you just said PIRs 
drives the commander's intel mission. 

Can you please explain to the court what 
you mean by that? 
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A Ma'am, the commander has a set of PIRs and 
PIRs stand for the intel that ' s key to his area of 
operation and his information that, as an analyst, you 
should key on in collecting any information. 

So, in other words, if Al Qaeda is going to 
use chemical weapons, okay, it may be a commander's 
PIR. So you want to know anything you can and do any 
research of anything dealing with chemical weapons that 
may be employed by Al Qaeda. 

Q And that consent of knowing what the 
commander is looking for and what your job in the 
S2 section is, that's a concept known by everyone in S2 
section? 

A It should be, sir. 

Q From the junior analyst to the most senior? 
A That's right. Roger. 

Q And all analysts understand, even junior 
analysts, that the information they pull will be used 
for predictive analysis? 

A They should understand that, absolutely 

right . 
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Q And that ' s your experience? 

A Yes, sir. 

Q Even the most junior? 

A Uh-huh . 

Q But you did not rely on the most junior to 
actually do the predictive analysis? 

A No, no, because they're not experienced 
enough . 

Q Okay . 

MR. FEIN: And, Your Honor, permission to 
publish dense exhibit delta-delta? 

THE COURT: Go ahead. 

BY MR. FEIN: 

Q So your example, Mr. Hall, you testified 
that, for example here — understanding this is 
completely made up for your testimony. . . 

A Yeah, I just made it up, sir. 

Q So in your example here — this is page 
1 — you have three towns, correct? 

A Yes, sir. 

Q And all junior analysts or senior analysts 
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would be able to plot this on a map based on — or 
should be able to? 

A Should be able to. 

Q And that ' s based off of their skills of 
reading a map? 

A Yes, sir. 

Q Okay. They should be able to explain what 
the towns are, town 1, town 2, town 3? 
A Yes, sir. 

Q They should be able to explain what the 
legend is and each of the codes in the legend? 
A Yes, sir. 

Q That a circle is an ambush, a diamond is an 
IED, a triangle is an attack on base. Even junior 
analysts would be able to get that information from 
reports? 

A Yes, sir. They should be able to read the 
legend. As I stated before, there's gotta be specific 
focus on the information that they're trying to obtain. 

Q And would expect junior analysts still, to, 
you mentioned, do the research and pull that 
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information to be put on this type of map? 

A They should be able to plot a "sit map," as 
we call it, a situation map. So they should be able — 
as a junior analyst, you should be able to go in and 
say, hey, I need you to research this information on 
town 2 and I need any information you can about ambush 
or IAD attacks. Their job would be to go into the 
database, pull all of their information and they should 
be able to plot that information on a map. 

Q And in order to pull that information and 
go into the right database, they have to understand 
what information they're looking at? 

A Absolutely. They should be specifically 
focused on — if I said I wanted information on IADs, 
this should only be researching for IADs . 

Q And you would expect that from a junior 
analyst? 

A Absolutely. 

Q And if that didn't happen, you would 
correct the junior analyst? 
A I would, sir. 
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Q And you also testified earlier that that 
type of analysis that's done by typically more senior, 
but the juniors contribute by doing the research, is 
used by commanders and leaders in the field? 

A Yes, sir. The information is always there. 
One the junior analyst does the research, ma'am, he 
brings that to the NCO or ICO that's in charge, 
understanding that these junior analysts — by research 
and information, he may not understand how to connect 
the dots. You have to be able to connect the dots to 
give the commander the big picture. 

I can use an example, weapons storage 
areas, okay? I'll use weapon storage areas. I may 
tell the junior analyst, hey, I need to know 
information about weapons storage areas . But if he ' s 
not familiar and hasn't been in the system long enough, 
he would not know where to look. 

So let ' s say there ' s a place that you would 
store weapons that they don't expect us to find them 
which would be like a school, church, a library. So a 
junior analyst would not necessarily know that. Okay? 
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So once we determine that, then they'd have 
to be close by, what's their avenue of approach to 
those locations to receive the weapons or to get the 
weapons? So that's connecting the dots and once you 
connect the dots, then you should be able to give an 
analytical overview of exactly what the threat is. 

Q And you would expect the junior analyst to, 
once they understand that weapon cachets are in 
schools, to be to go find data on schools and at least, 
at a minimum, plot the dots? 

A Yes, sir. 

Q And then maybe connect them or maybe not 
and get mentorship on how to connect them? 

A Right . They may not be able to know how to 
connect them, but they should be able to know how to 
plot and research any school within a certain mile 
there . 

Q And from your experience, Mr. Hall, that 
same process is used by our adversaries, correct? 
A Yes, sir. Absolutely. 
Q By our adversaries ' intelligence 
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organizations? 

A Yes, sir. 

Q And by terrorists? 

A Yes, sir. 

Q And they plot the dots to figure out what 

we do? 

A Just as we do the information on them, 
they ' re doing the information on us also . 

Q And if they had the information, that could 
be useful to them? 

A Yes, sir. Any information is an advantage. 

Q So if they now all the troop locations of 
where our troops were and they had that whole database, 
they could use it the same way as our junior analysts 
do? 

A Yes, sir. 

Q And that ' s something our senior analysts 
are trained? 

A Yes, sir. 

MR. FEIN: No further questions, Your 

Honor . 
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THE COURT: Redirect? 

REDIRECT EXAMINATION BY MR. COOMBS: 

Q Mr. Hall, with regards to our bases, 
locations of our bases — and you can tell me if you 
don't know this, but is it a secret where like Camp 
Victory was in Iraq or any particular FOB was in Iraq, 
do we try to keep that as a secret? 

A I don't know, sir. I mean, when you deploy 
to — I would think when you deploy to an area that 
you're going to be operating in, it's probably no 
secret because a lot of the locals will already know. 
As a matter of fact, they are some things that are 
probably a secret that they don't release, maybe a 
hidden train site that we may have that they don't have 
knowledge of. But as far as the major bases, of course 
not when you're deployed into an area. I mean, we're 
bringing a lot of money into that area and you're going 
to need the locals' help to get established. 

Q As far as the enemy is concerned, I guess, 
would they need to rely upon anything other than their 
eyes to see where the soldiers are in Iraq? 
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A Would they need to rely on anything else? 
Q Yeah, as far as if they see, like Camp 
Victory. I guess — correct me if I'm wrong, but if 
anybody looks at Camp Victory and see that ' s American 
soldiers, that's all they really need to know, American 
soldiers are there? 

A Yes, sir. But they would not know what is 
inside of that camp. 
Q Correct . 

Now, with regards to the open source, you 
were asked about how the open source might compare and 
I think the example was a bottle of water on a podium 
as opposed to a container of water on a table. 

Do you remember that example? 
A Yes, sir. 

MR. COOMBS: Your Honor, the defense 
intends to introduce the open source explanation for 
the charges SigActs under the same rationale as 703? 
THE COURT: Government objection? 
MR. FEIN: No objection, Your Honor. 
THE COURT: All right. 
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A VOICE: Pardon the interruption. We seem 
to have a cellphone here in the courtroom. 

THE COURT: Anybody that's got a cellphone, 
please leave the courtroom. Why don't we put the court 
in a brief recess and figure this out. Court in 
recess. Please don't discuss your testimony with 
anybody . 

(There was a recess taken at 3:42 and the 
trial resumed at 3:47 p.m.) 

THE COURT: Please be seated. Call to 
order. Let the record reflect all parties present at 
the last recess are again present. The witness is on 
the witness stand. I trust the cellphone issue has 
been resolved. 
BY MR. COOMBS: 

Q Mr. Hall, I'm showing you what's marked as 
defense exhibit echo-echo for identification. 

Can you take a look at that? 
A (Witness complied.) 

Q Do you recognize that? 

A It ' s one of the open source that I printed 
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and I released to one of the SigActs. 

Q And does that relate to both SigActs? 

A Yeah, I have two copies of the two examples 
in here. 

Q And there are highlighted portions within 
this exhibit. Did you make those highlights? 
A I did. 

Q Is that what you used in order to compare 
with the (inaudible) SigActs? 

A Yes, sir, with the two that I identified. 
MR. COOMBS: I offer echo-echo for 
identification into evidence as defense exhibit 
echo-echo . 

THE COURT: All right. Defense exhibit 
echo-echo is admitted. 
BY MR. COOMBS: 

Q Mr. Hall, you were asked about the 
classification and the various agencies that would have 
original classification authority over certain 
documents . 

Do you recall that? 
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A Yes, sir. 

Q And the government asked you about whether 
or not you could declassify certain documents that 
didn't belong to you, correct? 

A Right, sir. 

Q Have you declassified documents before? 
A I have. 

Q And what role were you declassifying 
documents? How were you doing that? 

A How was I declassifying the documents? 

Q Right. Were you declassifying as the 
original classification authority? 

A As the OCA's representative. 

Q And when you made the determination, was 
that the determination that declassified it or did 
somebody above you have to approve of your 
determination? 

A When we declassify the documents? No. 
Those — in the intelligence documents one thing you 
have to realize is that most of our information is 
basically protected. It basically has a shelf life, 
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okay, a shelf life maybe 25 years. But it goes beyond 
the 25 years. 

As I stated earlier, we don't — we never 
release sources and methods. Now, a lot of the 
information that comes across my desk has — contains 
sources and methods, but it was also kicked back and 
denied. We get requests every day that may come 
through — congressionals has been placed on us because 
of information of people seeking certain information. 
Okay. 

Once FOIA sends it up to me and the CGS 
entrusted the G2 directed into me, that we make the 
decision in the call when it comes to declass guides 
and he being briefed on the classification guide and 
what he's responsible for then that he is fully engaged 
in that because he is the OCA. The declassification 
works a little different because we have our FOIA 
office located here in Fort Meade who mostly sends the 
requests down to us . 

So let ' s say that there ' s a document that I 
stated that should remain classified or the FOIA 
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process, the way it works is that you have to give them 
something. So they may get one paragraph that's 
unclassified and the rest is redacted out. So that's 
how that process works. 

Q And when you make a determination to 
declassify something, is your determination then the 
one that declassifies it or does someone else have to 
approve of that? 

A No, no. Our office approves it. 

Q And who in your office approves it? 

A I am the approving official. It goes to — 
my director signs off because what we do is we send up 
a spreadsheet to the CG and to the historian of the 
documents that haven't been declassified. But probably 
about 95 to 97 percent of all of our documents contain 
under equities. So a lot of our documents have to be 
forwarded to NSA because before INSCOM you had the ASA 
which was the Army Security Agency which has 
information that deals with special intelligence that 
has to go to NSA for the final approval. 

Q You were asked questions about, you know, 
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if another agency was the equity holder, that you 
wouldn't make a classification determination on that 
information? 

A No, I would not. 

Q And is that because that's just — that's 
the way the rules are built and it ' s only the OCA that 
can talk about their information? 

A If you really think about it, I mean, why 
would my commander at INSCOM declassify something from 
CentCom? That's not his area of responsibility. He 
doesn't know the information. 

So it's always been, basically, law and by 
the regulation that you have to refer back to the OCA. 

Now, if you have deactivated and let ' s say 
it disbanded probably 10, 15 years ago, then I would 
send it up to the Army G2 . Then they would make the 
determination. But we wouldn't make it at INSCOM. 

Q And based upon how the classification 
process works, would you defer to an OCA and that OCA's 
opinion when it comes to their information? 

A Would I defer to the OCA it belonged to? 
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Q Correct . 
A Yes. 

Q And that is because that's the process that 
you live under? 

A That ' s the process I deal with that follows 
the regulation and policy as well as executive orders 
380-5. 

Q And as you sit here today, would you ever 
disagree with another OCA? 

A No, I would not. I mean, I don't think 
another OCA would either. 

MR. COOMBS: Thank you. 

THE COURT: Anything else? 

MR. FEIN: May the government have a sort 

recross? 

THE COURT: Yes, and then following with 
redirect if you need to. 

MR. FEIN: Your Honor, I'm handing the 
witness prosecution exhibit echo-echo, unclassified, 
and defense — I'm sorry, I said prosecution. Defense 
exhibit echo-echo and defense exhibit whiskey and 
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x-ray . 

RECROSS EXAMINATION BY MR. FEIN: 
Q Mr. Hall, those are the two SigActs in 

whiskey and x-ray that you reviewed for open source 

information? 

A Yes, sir. 

Q And the binder is the information you found 
that you highlighted? 
A Right . 

Q Could you please flip to defense exhibit 
x-ray? That's a five-page SigAct? 
A Okay, sir. 

Q I'm sorry, it is a five-page SigAct? 
A You said x-ray? 
Q Correct . 
A Yes, sir. 

Q And when you searched in the open source 
information that's in that binder, you highlighted 
information in the binder that you think matches the 
information in the SigAct, correct? 

A Roger . 
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Q But not necessarily exactly? 
A Right . 

Q And so whether it is the podium water 
bottle example or something else, any other example in 
there, they aren't necessarily identical? 

A Roger . 

Q And based off your experience, then, is 
there a difference between the actual U.S. government 
information as released by the government versus 
something that ' s in the public domain? 

A Of course there ' s a difference . 

Q And what ' s the difference ? 

A The government information is protected and 
it's a lot more in detail. With the open source, you 
get a quick snapshot of maybe one word or two words. 
That just tells you of an incident that may have 
happened, but you do not get any of other identifying 
data, so to speak, as in any of the classifications, 
stuff like that . 

Q And are intel analysts, even junior ones, 
trained that information that is U.S. Government 
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information is more valuable to the enemy than open 
source information? 

A Oh, yes. 

Q And why is that? 

A Because, I mean, it's something that 
belongs to the U.S. government and it's protected. 
It's protected for a reason. 

Why would we want to release that to anyone 
outside of the U.S. Government? 

Q And, sir, you would agree by looking at 
defense exhibit whiskey and x-ray right there that 
those SigActs include details of missions? 

A Uh-huh . 

Q Details of what they — what the missions 

did? 

A Yes, sir. 

Q It isn't just, necessarily, a snapshot in 

time? 

A No. Some — as I stated before, some 
SigActs can be detailed, but when they first report a 
SigAct, it's not probably not detailed. So when they 
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get back, they can edit and make it more detailed 
information. 

Q And that ' s what — the type of information 
you saw in all of the SigActs you reviewed for this 
case? 

A Right . 

Q Thank you. 

MR. FEIN: Your Honor, I'm retrieving 
defense exhibits whiskey and x-ray and echo-echo. 

THE COURT: Any final redirect? 

MR. COOMBS: No redirect. 

THE COURT: I'm just a little confused on 
declassification questions. 

Now, when you're declassifying something, 
do you have the final file — you have a FOIA request 
coming in and they want ten classified documents. 

Now, when you're making these 
declassification decisions, are you doing it — you 
said that the documents have a shelf life. So say the 
shelf life says or the document says it ' s due for 
declassification in five years. 
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THE WITNESS: Yes, ma'am. 

THE COURT: Do you have the authority to 
say, well, I'll declassify it now? 

THE WITNESS: If it's information that we 
can release. But keep in mind, as I stated with intel 
information, we go way beyond the 25-year mark because 
of the sources and methods and the type of information. 

Most information that I've seen that have 
came across my desk since I been in INSCOM has been 
either history related, it's been a lot of sources and 
methods, but a lot of our information is embedded with 
NSA. 

So, as I stated, we was under the old ASA, 
Army Security Agency. So, therefore, defenses — 
there's probably, like, four boxes that I had to ship 
to NSA. So they have a year, basically, to get it back 
to you. Well, they didn't get it back to me until 
probably for about 13 months. But their decision was 
that this information remains protected because we had 
to defer to them because, under the old ASA, the 
information, even though we created the information, 
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but it has some special intelligence that was inside. 

So to answer your question, ma'am, yes, I 
can. But we have to use judgment when we do that. The 
FOIA office, our FOIA office that belongs to us here up 
in Fort Meade, when they send the documents down — 
because they handle all the congressional that's put on 
us. So, for instance, I got a call one day about a 
couple of documents and they say, hey, Mr. Hall, we 
really need for you to look at this again because it 
had came across my desk like about four times. 

So she said, hey, look, we got to give them 
something. I said, well, okay, this is what we can do. 
So we work together as a team understanding that they 
have to give the requester something but as far as it 
to remain classified, for it to be declassified, that 
rests with us in the G2 . 

THE COURT: Thank you. Any followup based 

on that? 

MR. COOMBS: No, Your Honor. 

MR. FEIN: Yes, ma'am. 

RECROSS EXAMINATION BY MR. FEIN: 
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Q Mr. Hall, I listened to your example. 

Why did you use 25 years when you said 
shelf life of 25 years? 

A Why do we use it? 

Q Where does that number 25 come from? 
A It's an executive order. 
Q And what is that number? 
A 13526. 

Q I'm sorry. What is the number 25 years? 
Why is that significant? 

A Because it's for HUMINT, for HUMINT 
intelligence . 

Q And that's the default setting, the default 
declassification date? 

A Uh-huh . 

Q So even in an example of two months, one 
month, five years, 25 years, when you get a document 
for declassification, it could be extended past that 
declassification, correct? 

A Actually, under the new policy, if 
something has comes out within the intel community, 
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HUMINT information is declassified at 50 years. So, 
actually, you're getting the total close to 75 years 
out of HUMINT information. 

Q Okay. But even if it's not HUMINT intel, 
it could be — 

A Intel, right, it's still... 

Q Any type of classified information, when 
you receive it for declassification, the mandatory 
declass state doesn ' t necessarily mean it ' s 
declassified? 

A No. You can extend it now for another 25 

years . 

Q And no matter what date is on that 
document, it still goes through a review process? 
A Absolutely. 

MR. FEIN: Thank you. 

THE COURT: Temporary or permanent excusal? 
MR. COOMBS: Permanent. 

THE COURT: Mr. Hall, you are permanently 
excused. You're free to go or stay in the courtroom. 
THE WITNESS: Yes, ma'am. 
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88 



MR. COOMBS: Defense calls Mr. Ganiel. 

Whereupon, 

CHARLES GANIEL, 

called as a witness, having been first duly sworn to tell the truth, 
the whole truth, and nothing but the truth, was examined and testified 
as follows: 

MS. OVERGAARD: Mr. Ganiel, are you Charles 

Ganiel? 

THE WITNESS: Yes, ma'am. 

DIRECT EXAMINATION BY MR. COOMBS: 
Q Mr. Ganiel, are you a security specialist 
with the Army ' s test and evaluation command? 
A Yes, I am. 

Q And how long have you been there? 
A Since March 2010. 

Q And were you assigned as a security expert 
for defense in this case? 
A Yes, I was. 
Q And when was that? 
A Around August 2010. 

Q And how were you specifically assigned to 
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the defense? 

A After you requested a security specialist 
be assigned to the defense team, we got the call to go 
to the Pentagon for a briefing and Major Fein actually 
told me I was going to be assigned to the defense team. 

Q And when you became a part of the defense 
team at that point, did I start to use you as my 
defense expert? 

A Yes. 

Q And in that role, did you review the charge 
diplomatic cables in this case? 
A Yes, I did. 

Q Did you also review the classification 
review by Ambassador Patrick Kennedy? 
A Yes, I did. 

Q Mr. Ganiel, are you prepared today to tell 
us about your review of the charged diplomatic cables 
in this case? 

A Yes, I am. 

Q Let's begin by talking about your general 
background . Okay ? 
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A Okay . 

Q How long — well, actually, how did you get 
hired by the Army tested evaluation command? 

A I applied for the job and was hired based 
on my experience and past assignments. 

Q Can you describe for the court what you do 
on a typical day with ATEC? 

A I'm the command special security office. I 
have oversight on all the sensitive department of 
information facilities throughout the command. 

I also make sure all the SCIFs have all 
their accreditations, may sure all the classified 
information is being properly protected and I write 
specific ATEC SCIF policy and also conduct inspections. 

Q Have you ever been in the military? 

A Yes, I have. 

Q And how long were you in the military? 
A Just shy of 28 years. 

Q And what was your MOS in the military? 
A I was a 3P0, security police which is 
broken is broken down into security specialist and law 
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enforcement specialist. I was the security specialist. 

Q And can you tell the judge briefly some of 
previous assignments you had while in the military? 

A I'll just sum it up. Through all my 
assignments I had, for the first 16 years I did 
everything from patrolman to alarm monitor to night 
sergeant to desk sergeant to personal security, 
information security, quality control evaluator. Then 
I did a special duty assignment as a first sergeant and 
then, after that, I came back to the security career 
field and I was security forces manager at (inaudible) 
Air Force base. 

Q And what did you do as the security forces 
manager? 

A Oversaw all the enlisted personal, security 
personnel assigned to the unit as well as the Navy 
security guards and DOD contractor guards. 

Q When did you retire from the military? 

A April 1st, 2007. 

Q And what was your rank at the time of your 
retirement? 
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A 



Chief master sergeant. 



Q 



Is that an E9? 



A 



E9. 



Q 



What did you do after retiring? 



A 



I was hired by the Bowen Company in 



St. Louis, Missouri. I was hired as an industrial 
security specialist and there I did contractor special 
security officer duties, responsible for protecting 
Bowen proprietary and government classified 
information, basically. 

Q And how long were you with Bowen? 

A About two years. 

Q And then where did you go? 

A I was hired by the defense contract 
management agency. I was the manager of security 
information technology for the special programs branch 
on the west coast. 

Q And what did you do in that position? 

A Oversaw all security, basically, on all of 
our different facilities through DCMA. 

Q And how long were you in that position? 
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A About 13 months. 

Q After that, where did you go? 

A Then I was hired by ATEC. 

Q How many years in total have you been 
handling classified information? 

A I would say off and on probably 34 years. 
MR. COOMBS: Your Honor, at this time, we 
tender Mr. Ganiel as a security subject matter expert 
in dealing with classified information. 

THE COURT: Any objection? 

MS. OVERGAARD: The government would object 
to "dealing with." But the government would not object 
to handling classified information. He testified that 
his expertise was in actually handling classified 
information, not necessarily in the content of the 
information. But in actually handling the information. 

THE COURT: So tell me the phrase you used? 

MR. COOMBS: I said in dealing with 
classified information. I believe he said on and off 
he ' s been dealing with classified information for 34 
years . But I think it ' s little bit of semantics unless 
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the government believes there ' s a difference between 
dealing with and handling. 

MS. OVERGAARD: The government is not 
exactly sure what "dealing with" means. 

THE WITNESS: I was going to say dealing 
with classified is anything known to have protected 
information on how to use it, how to properly store it, 
whether it ' s a hard document or it ' s a piece of 
equipment or it's a nuclear weapon, whatever. 

MS. OVERGAARD: And the government would 
agree with all of those specific characterizations. 

THE COURT: All right. We'll use the world 
dealing to encompass the characterizations the witness 
just described. 

So you're not looking at going beyond that, 

right? 

MR. COOMBS: No, your Honor. 
BY MR. COOMBS: 

Q Mr. Ganel (sic), let's turn to what you did 
in this case. 

A Ganiel . 
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Q I'm sorry, Mr. Ganiel. I apologize. 

First, can you tell the court generally 
what you did in this case? 

A Reviewed the cables. And then after that, 
reviewed the OCA's determination, then did some open 
source information review. 

Q And why did you review the charge diplomat 
cables in this case? 

A Just to see what their classification level 

was . 

Q And how did you conduct the review of the 
cables? 

A As far as doing the open source or. . . 

Q As far as how did you identify which cables 

and — 

A We looked at the charge cable sheet and 
just verified what the classification was and then 
compared that with the OCA's determination. 

Q And did you review all of the cables in 
this case? 

A The charge cables, yes. 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 07/09/13 Afternoon Session 



Q How many cables did you review? 
A I think it was 125. 

Q And with regards to the classification 
determination, you said you also reviewed the OCA's 
classification determination? 

A Right . 

Q And why did you review that? 

A Just to see why the OCA determined it 
should be — the cable should still remain classified 
and his determinations behind that or his reasons 
behind that. 

Q And what did you do after reviewing the 
OCA's classification determination? 

A I then did an open source search for 
information relating to that cable. 

Q And I imagine — did you do open source in 
all 125 cables? 

A Yes. 

Q And how did you capture the open source 
information or how did you conduct that research? 

A We just did, basically, a search, anything 
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prior to the actual Wikileaks release. Just put a date 
in there and maybe look for a word or two or any event 
that may have happened. 

That ' s how we did our search . 
Q And can you explain that process as far 
as — let's say you take a particular cable. 

What would you do to find the open source 

information? 

A For some of the cables, for instance, Major 
Hurley would say, hey, look for this or look for this 
and that's what we'd do and we'd put a date range in 
there. If something came out that we thought related 
to that cable, what they were talking about, that's 
what we printed off. 

Q When you say a date range, how did you do 
your date range? 

A Anything basically prior to the Wikileaks . 
Let's say the cable was written in March 2003. 
Anything prior to March 2003 to anything prior to the 
Wikileaks release. 

Q Once you found the open source — 
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THE COURT: Wait a minute. Anything prior 
to March 25, 2003? 

THE WITNESS: Let's say the cable was 
written March 2003. So we may have gone maybe February 
2003 until whenever the Wikileaks release was. 
BY MR. COOMBS: 

Q How did you organize the open source 
information once you found it and printed it? 

A Just put it in different binders . 

Q And can you explain that? 

A Yeah, we highlight the binders or 
highlighted what we found in the open source that we 
thought compared to the cable itself and then put them 
in the binders and then highlighted the same thing on 
the cable. 

Q And how many of the cables were you able to 
find open source information on? 

A I believe it was all but probably two of 
the cables. 

Q Sorry, go ahead. 

A One or two of the cables I think we didn't 
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find something on. 

Q And when you found open source information, 
did you find multiple examples of open source 
information for the cables? 

A Yes. In some instances, there may have 
been four documents that we found that we printed out. 
There may have only been one. I might have had three 
depending on what it was. 

Q And based upon the information that you 
found, did you reach any conclusions about the charge 
cables? 

A I just felt that a lot of the information 
was already out in the public domain by doing my 
research. 

Q Mr. Ganiel, have you ever worked for the 
Department of State? 
A No. 

Q Does your job require you to review 
information for the Department of State? 
A No, it doesn't. 

Q Have you ever been or are you now an 
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original classification authority? 
A No , I ' m not . 

Q In your field, would you ever publicly 
disagree with an original classification authority? 

A No. In our field, the OCA's determination 
is binding. What he says goes. If he says it's 
secret, that's how you treat it. Just like — let's 
say my two star came to me and said let's do this, 
let's change this, let's change this policy or 
whatever. I may disagree with him. We may talk about 
it behind closed doors. But when we leave that door, 
we do what he says. 

Q Now, in this instance are you disagreeing 
with the OCA's determination regarding the charge 
cables? 

A No , I ' m not . 

Q Mr . Ganiel , I'm handing you what ' s been 
marked as defense exhibit Yankee for identification and 
then also defense exhibit zoo for identification. Take 
a look at both of those and then look up to me when 
you're done. 
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A (Witness complied.) 

Q Do you recognize those two exhibits? 

A Yes, I do. 

Q How do you recognize them? 

A It ' s one or two of the cables that we 
looked and we found open source information on them and 
we highlighted those cables or I highlighted those 
cables . 

Q And you said you highlighted those cables. 
Do both of those exhibits have highlights 

in them? 

A Yes, they do. 

Q And how did you determine what information 
to highlight? 

A If we found something in the open source 
that we thought matched up with it, that's — we would 
highlight it. 

Q And did what you found in the open source 
match up verbatim, word for word? 

A No. 

Q So how did you determine, when you looked 
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at something in the open source, that that would 
something that you would highlight in the charge 
cables? 

A Well, let's say one of these had to do with 
an event that happened maybe in Africa. If we found 
something similar to that that looked like it matched 
up, that's what I would highlight. 

Q And did you do this for all 125 cables? 

A No, I didn't. 

Q And why not? 

A That would have been — that would have 
taken forever. Too time consuming. I just wanted to 
do this as an example of what we thought was already 
available on the open source. We probably could have 
done that if we took the time to do it at all. 

MR. COOMBS: Your Honor, at this time, I'm 
retrieving both exhibits from the witness. And the 
defense moves into evidence defense exhibit yankee and 
defense zoo for identification. 

MS. OVERGAARD: The government would just 
request that, based on the highlights in those cables, 
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that the data that the expert used to underline — that 
underlines his opinion would also be admitted, ma'am. 
That would assist the fact finder in actually 
determining the probative value of the expert ' s 
opinion . 

THE COURT: Are you planning on doing that 

as well? 

MR. COOMBS: At the government's request, 
that's not a problem. I'll just have it marked, Your 
Honor . 

THE COURT: Other than that, no objection? 

MS. OVERGAARD: No objection, ma'am. 

THE COURT: All right. Defense exhibits 
yankee and zoo are admitted. 
BY MR. COOMBS: 

Q And while the court reporter is marking the 
open source information, I'll have you identify that. 

Does that open source information contain 
the specific paragraphs where you might be able to find 
the information in the charge documents? 

A We have another that we also marked like 
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that that we try to match it up with that . 

Q So, if asked, you could highlight or you 
could show where any open source information — in 
addition to just the highlights, where exactly that 
open source information would be found in the charge 
cables? 

A Right . 

Q I'm showing the witness what is marked as 
defense exhibit — I'll go ahead and mark it for 
identification . 

Can you look at that? 
A (Witness complied.) 

Okay. 

Q Mr. Ganiel, do you recognize exhibit 
foxtrot-foxtrot? 

A Yes, this is the open source that I 
highlighted that I thought matched up to cables. 

Q Retrieving the exhibit from the witness. 
At this time defense moves into evidence — 
foxtrot-foxtrot for identification into evidence as 
foxtrot-foxtrot . 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 07/09/13 Afternoon Session 

105 

THE COURT: All right. Defense Exhibit FF 

is admitted. 

MR. COOMBS: No further questions. 

THE COURT: Government? 

MS. OVERGAARD: One moment please, Your 

Honor . 

CROSS EXAMINATION BY MS. OVERGAARD: 
Q You said, Mr. Ganiel, that your expertise 
is in protecting classified information, correct? 
A Yes, ma'am. 

Q And not in evaluating Department of State 
content? 

A That ' s correct . 

Q And you are trained specifically on the 
procedures of protecting the physical four corners of 
the document? 

A Yes, ma'am. 

Q And other physical — you talked about 
missiles and airplanes, things of that nature? 
A Right . 

Q So you know enough about the content to 
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refrain from disclosing or confirming government 
information inappropriately? 
A Yes, ma'am. 

Q But you rely on those markings that are 
actually on the documents? 
A Yes, ma'am. 

Q Why is it important to protect that 
information? 

A Well, it's the government's close held 
secrets. They own the information and I can't disagree 
with what they say and how they mark it. So we're 
obligated to protect it. 

Q And when you say they, who is in the best 
position to determine the interests or risks implicated 
by the classified information? 

A The OCA. 

Q And why is that? 

A They basically own the information. They 
market it . They chose the classification labels . 

Q And you know that, when the OCA classifies 
something, it has to be treated that way? 
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A Right . 

Q And that regardless of your personal 
beliefs? 

A Right . 

Q And you said you reviewed some of the 
charge cables? 

A All 125 cables. 

Q You reviewed all 125, but you highlighted 
just some of the charge cables? 
A Yes. 

Q Okay. And that was based on key words that 
were pulled out by you or Major Hurley or someone else 
on the team? 

A Right . 

Q And you limit it by a date range? 

A Date range. Anything prior to the actual 
Wikileaks release, basically. 

Q Okay. So what was that date, do you 
remember? 

A Sometime in 2009 or '10. I'm not sure of 
the exact date. 
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Q Okay. And the majority of the cables that 
they looked at had both classified and unclassified 
portions in them; is that correct? 

A Right . 

Q And the searches that you actually did in 
open source, they are you all unclassified? 
A The searches? 

Q Yes. You weren't typing classified 
information into Google? 

A No. Whatever words he would give us, we 
just type in there and look for it. Just because the 
paragraph is classified, you don't know exactly what 
word in there was classified. It could have been one 
word or it could have been a whole paragraph. 

Q But the searches that you actually 
conducted on Google, they were unclassified, correct? 

A Right . 

Q And the majority of the information that 
you found was from news sites? 

A What is news sites? 

Q In the examples that I was looking at with 
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CNN and it was — 

A Oh, news sites. It could have been a 
paper. It could have been anything. 

Q Okay. But not many examples from official 
U.S. Government sources? 

A No. 

Q And regardless of the source of the 
information, you basically pulled up factual 
information, correct? 

A That we thought related, yes. 

Q So, like, this person was a leader of this 
country at this time? 

A Right . 

Q Or this person was here. I think that was 
example you gave me before. This person was here at 
this particular time? 

A Right . 

Q You said open source information existed on 
all but two of the cables, about? 

A I'm pretty sure it was all but two. 
Q That was just the general factual 
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information that you recall? 

A Right. Nothing is word-for-word. It's 
just — it could be a couple words here, couple words 
there. Maybe something else that happened that we 
found in there. 

Q And did you find any information in open 
source where the government confirmed any of the 
classified information in the cables? 

A No. 

Q Or any U.S. Government analysis that was 
actually in those cables? 
A No. 

Q Or any official U.S. Government commentary 
that was in those cables? 
A No. 

Q And you never found in any of them all of 
the information that was in the cables? 
A No. 

Q And when you did your — when you did the 
highlights and when you did your estimation of what was 
or wasn't in open source that was actually in the 
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cables, did you look at how the paragraphs were marked, 
whether the paragraphs in the cable were SBU, which was 
sensitive but unclassified, or unclassified or if they 
were confidential or secret? 

A We looked at the cable and then we just — 
whatever words they came up with to research, that's 
what we do. 

Q But when you did your actual — you said 
before a lot of the information you felt or at least 
some of the information was in the open source. 

Did you break it down by what in the cable 
was unclassified versus what in the cable was 
classified? 

A No. 

MS. OVERGAARD: We're retrieving defense 
exhibit yankee and foxtrot-foxtrot . Let ' s compare some 
of these . It ' s somewhat difficult to do in an open 
forum, but I'm just going to generically describe 
things to you and if could you just generically point 
them back. Maybe, actually, if you marked on the 
document that would be easier so then the judge 
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could — 

THE COURT: It's already admitted. 

MS. OVERGAARD: So don't mark on the 
document. So if you could just describe, generically, 
where the information is? 

THE COURT: You want to make a xerox of the 
document and admit another A or B? We can do it that 
way. 

MS. OVERGAARD: That would probably be 

easier. 

THE COURT: You want to take a recess? Any 

objections? 

MR. COOMBS: No objections, Your Honor. If 
it would help, we also have a premarked exhibit for 
this that shows by paragraph where it ' s located if it 
may assist the government. 

THE COURT: Why don't we take a brief maybe 
ten-minute recess? Is that long enough to figure this 
out? 

MR. COOMBS: Yes, Your Honor. 

THE COURT: All right. Mr. Ganiel, please 
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don't discuss your testimony of knowledge of the case 
with anyone during the recess. The court is in recess. 

(There was a recess taken at 4:24 and the 
trial resumed at 5:52 p.m.) 

THE COURT: Please be seated. The court is 
called to order. Let the reflect all parties present 
when the court last recessed are present in court. The 
witness is on the witness stand. 

Now, during the recess, which was extended 
several times, I believe the parties were trying to 
figure out a way forward with this witness . . . 

MR. FEIN: Yes, ma'am. 

THE COURT: And the way forward is? 

MR. FEIN: Yes, ma'am. The parties agreed 
jointly that the best way forward for the remainder of 
the at least cross-examination of Mr. Ganiel is to 
actually meet with the government tonight, actually go 
through this documentation to create a separate set of 
the document to mark up similar to what he did with 
defense and that would allow this to be a much more 
streamline process . Essentially it ' s almost a MRA 
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505 substitute instead of having to either close the 
session based on the classified information or use 
numbers and references . It ' s just a much easier and 
more efficient use of the court ' s time . 

THE COURT: All right. 

MR. FEIN: I'm sorry, and we propose the we 
recess for the night now and meet with the witness 
tonight and then we'll reconvene at 9:30 tomorrow to 
start the cross-examination. 

THE COURT: All right. Defense, do you 
concur with that course of action? 

MR. COOMBS: Yes, Your Honor. 

THE COURT: And during the recess I had 
several items with counsel to basically discuss the way 
forward with respect to this witness as well as another 
witness who will be testifying tomorrow, Mr. Benkler. 

Do we have any outstanding issues to 
address with him? 

MR. FEIN: No, ma'am. Professor Benkler 
will be here tomorrow morning ready to testify. 

MR. COOMBS: Defense concurs. 
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THE COURT: All right. Is there anything 
else we need to address at this point before we recess 
the court until 09:30 tomorrow? 

MR. COOMBS: No, ma'am. 

MR. FEIN: No, ma'am. 

THE COURT: Mr. Ganiel, please don't 
discuss your testimony or knowledge of the case with 
anyone other than counsel or the accused during the 
recess and we'll see you at 09:30 tomorrow morning as 
well. Court is in recess. 

(Court adjourned at 5:55 p.m.) 
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